Executive and Cyber Coverage Toolkit: Policy Comparisons, Notice Letters, and Allocation Analyses

Document type: Toolkit Practice area: Corporate — Insurance and Risk Jurisdiction: United States Last reviewed: 5 September 2026

Tool 1 — Tower comparison matrix

Request this from the broker at every placement. Read it. The differences are where claims fail.

Provision	Primary	XS 1	XS 2	XS 3	Side A
Carrier / limit / attachment
Notice address and method
Notice standard (ASAP / fixed days)
Definition of "Claim"
Definition of "Loss"
Definition of "Insured Person"
Conduct exclusion trigger
Severability of exclusions
Application severability
Side A non-rescindable
Insured v. insured carve-outs
Allocation provision
Exhaustion language
Drop-down
Consent to settle / hammer
Panel counsel required
Choice of law
Arbitration
Extended reporting period
Change of control
Exclusions not in primary

How to use it. Every "different from primary" cell is either negotiated into conformity before binding or written into the claims runbook as a requirement that must be separately satisfied. At claim time the company must meet the strictest requirement in the tower.

Tool 2 — Coverage enhancement request list

Send to the broker 90 days before renewal, in priority order, and ask for each carrier's response in writing.

D&O

Dedicated Side A limit of $____, with difference-in-conditions and drop-down.
Conduct exclusions triggered only by final, non-appealable adjudication in the underlying proceeding.
Side A non-rescindable; full severability of the application; knowledge imputed only from named signatories.
Insured-versus-insured carve-outs: derivative suits without insured assistance; bankruptcy trustee, examiner, receiver, liquidator, creditors' committee, debtor in possession; former officers after ___ years; whistleblowers; cross-claims; foreign representatives.
Pre-agreed 100% allocation for securities claims where entity and insured persons are co-defendants.
Investigation coverage from the first written request for documents or information, not from a formal order; covering insured persons and, to the extent available, the entity.
Exhaustion satisfied by payment "by the underlying insurers, by the Insureds, or on their behalf"; express non-prejudice for below-limits underlying settlements on notice.
Definition of Claim to include written demands, shareholder demand letters, books and records demands, subpoenas, Wells notices, and tolling requests.
Notice standard "as soon as practicable"; single notice address across the tower.
Run-off terms pre-agreed: 6 years at ___% of expiring premium, non-cancellable, fully earned.
Prior and pending litigation date advanced to ____.
Bodily injury/property damage exclusion carved back for defence costs in derivative actions.

Cyber

Social engineering sublimit raised to $____; vendor and client impersonation included; verification condition conformed to our documented AP procedure (attached).
Contingent business interruption on a blanket basis, or with the providers on Schedule ___ scheduled by name.
Waiting period reduced to ___ hours; period of restoration extended until normal operations resume.
War/hostile act exclusion: attribution standard requiring formal governmental attribution supported by evidence; carve-back for collateral damage to a non-target; burden on the insurer.
Infrastructure exclusion carved back for failures caused by a covered cyber event.
Our preferred incident response firm, forensic firm, and counsel added to the panel: ____.
Regulatory fines and penalties where insurable; PCI assessments included.
Extortion consent obtainable within ___ hours, with a named 24×7 contact.
Retroactive date of ____; full prior acts.
Interim payment provision for undisputed first-party amounts.

Tool 3 — Notice of claim letter

Send to every layer, by the method each specifies, within days.

[Date] — [Method specified in the policy] To: [Claims notice address for this layer, exactly as stated in the policy] Copy: [Broker]

Re: Notice of Claim — Policy No. [], Policy Period [], [Insurer], [Layer]

Dear Sir or Madam,

[Company] gives notice of the following Claim under the above policy.

The Claim. On [date], [Company] and [named insured persons] were served with [describe: complaint / demand letter / subpoena / formal order] in [matter name and forum, if applicable]. A copy is enclosed.

Date first made. [Date]. [If applicable: This Claim arises from the circumstances of which notice was given on [date] under Policy No. [____], and [Company] contends it is deemed first made on that date.]

Insureds involved. [List: entity and each insured person by name and title.]

Alleged Wrongful Acts. [Two or three sentences summarizing the allegations, neutrally.]

How [Company] learned of the Claim. [Brief.]

Defence. [Company] has retained / proposes to retain [firm] as defence counsel and requests the Insurer's consent. [If a panel is required: [firm] is / is not on the Insurer's panel, and [Company] requests consent to its retention.]

Requests. [Company] requests (i) confirmation of receipt; (ii) confirmation of coverage or a statement of any coverage position; (iii) consent to the retention of defence counsel; and (iv) confirmation of the Insurer's litigation guidelines and rate position.

Reservation. [Company] reserves all rights. This notice is given without prejudice to any position regarding coverage, allocation, or the date the Claim was first made.

Yours faithfully, [Name, title]

Retain proof of delivery for every layer. File it with the policy.

Tool 4 — Notice of circumstances letter

Draft broadly. A notice too narrow will not capture the claim that eventually arrives.

Re: Notice of Circumstances — Policy No. [], Policy Period []

Pursuant to Section [___] of the above policy, [Company] gives notice of circumstances that may reasonably be expected to give rise to a Claim.

The circumstances. [Describe the event with specificity: what happened, when, who was involved, what has been disclosed publicly, what investigations or inquiries exist.]

Potential claimants. Without limitation, these may include: shareholders and purchasers of the Company's securities; [regulator]; [counterparty]; current and former employees; and any other person asserting loss arising from the matters described above.

Potential Wrongful Acts. Without limitation: alleged misstatements or omissions in [describe]; alleged breach of fiduciary duty in connection with [describe]; alleged failure of oversight or internal control in respect of [describe]; alleged violations of [statutes]; and any other act, error, or omission arising from or relating to the circumstances described above.

Insured Persons who may be involved. [Company]'s directors and officers, including without limitation [named individuals], and any other Insured Person who may be alleged to have participated in or had responsibility for the matters described.

Anticipated Claims. [Company] anticipates that Claims arising from these circumstances may include securities class actions, shareholder derivative actions, books and records demands, regulatory proceedings and investigations, and related proceedings.

[Company] requests that any Claim subsequently made arising out of, based upon, or attributable to these circumstances be deemed first made during this Policy Period.

[Company] reserves all rights.

Drafting note. The three "without limitation" lists are the point. A circumstance notice that names one claimant and one wrongful act will be argued not to capture the claim that arrives eighteen months later from a different claimant on a different theory arising from the same facts.

Tool 5 — Response to a reservation of rights

Do not ignore one. A short, factual response preserves the record and often narrows the reservation.

Re: Your letter of [date] — Policy No. [____]

[Company] acknowledges the Insurer's letter of [date] and responds as follows. [Company] does not accept the reservations asserted and reserves all rights.

1. [Reservation as stated — e.g., "the Insurer reserves rights under the Conduct Exclusion"]. The Conduct Exclusion applies only upon a final, non-appealable adjudication in the underlying proceeding establishing the conduct. No such adjudication exists, and the Insurer's obligation to advance Defence Costs is unaffected. [Company] requests that this reservation be withdrawn or, at minimum, that the Insurer confirm it will advance Defence Costs pending any such adjudication.

2. [Reservation — e.g., "the Insurer reserves rights as to allocation"]. Section [___] provides a pre-agreed allocation of 100% of Loss to covered Loss in a Securities Claim in which both the Company and Insured Persons are defendants. That provision applies on its terms. [Company] requests confirmation that no allocation issue arises.

3. [Reservation — e.g., "the Insurer reserves rights as to the timeliness of notice"]. The Claim was first made on [date] and notice was given on [date], [N] days later, by [method] to [address], being the address specified in Section [___]. Proof of delivery is enclosed. The notice was given as soon as practicable. [Company] requests that this reservation be withdrawn.

4. Requests. [Company] requests that the Insurer (i) identify any additional information it requires; (ii) confirm the advancement of Defence Costs; and (iii) confirm the rate and staffing position for defence counsel.

[Company] will continue to cooperate. Nothing in this letter waives any right.

Tool 6 — Exhaustion and gap-funding agreement

Use when an underlying layer settles below its limit. Obtain from every excess carrier above the settling layer, in writing, before the settlement is signed.

The Insureds and the Underlying Insurer have agreed to settle the Underlying Insurer's obligations under Policy No. [____] for $[amount], which is $[gap] less than the Underlying Limit of $[limit].

[Insurer] confirms and agrees that: (a) the Underlying Limit shall be deemed exhausted for purposes of attachment of Policy No. [____] upon payment of $[amount] by the Underlying Insurer and the funding of the remaining $[gap] by the Insureds or on their behalf; (b) [Insurer] shall be liable under its policy for Loss in excess of the Underlying Limit as if the Underlying Insurer had paid its full limit, and shall not assert that its policy has not attached by reason of the below-limits settlement; (c) [Insurer] has been given notice of and does not object to the settlement; and (d) nothing in this agreement waives any other right, defence, or coverage position of [Insurer] or of the Insureds.

Drafting note. Obtain this before the underlying settlement is executed. After execution, the excess carrier has no reason to agree and every reason to argue.

Tool 7 — Allocation analysis

Where no pre-agreed allocation applies.

1. Parties. Covered insureds: _. Uncovered parties: ____ (basis for exclusion: _). 2. Claims. Covered claims and theories: _. Uncovered claims and theories: ____ (basis: ). 3. Defence costs. Total to date $. Costs attributable solely to uncovered parties or claims: $_ (identify). Costs common to both: $_. 4. Method proposed. □ Relative exposure □ Larger settlement rule □ Negotiated percentage □ Other 5. Larger settlement analysis. Would the settlement have been materially smaller absent the uncovered parties or claims? If no — because the individuals and the entity are sued for the same conduct — the incremental amount attributable to uncovered parties is nil and the insured position is 100% allocation. 6. Relative exposure analysis. Realistic exposure of covered parties: $_. Of uncovered parties: $____. Implied allocation: ____%. 7. Interim position. Pending final determination, the Insurer shall advance ____% of Defence Costs, without prejudice, subject to reallocation on resolution. 8. Reservation. Both parties reserve all rights.

Tool 8 — Incident cost capture protocol

Activate on day one of any cyber event. This is what makes a first-party claim payable.

Dedicated cost centre / project code opened; all incident costs booked to it and to nothing else
Instruction issued to finance: no incident cost to be booked to ordinary operating accounts
Hourly operational log commenced: systems affected, functions unavailable, time down, time restored, workaround in place
Production, shipment, transaction, or service volume data captured hourly or daily for the interruption period and for the four weeks preceding
Every vendor engagement documented: scope, rate, authorization
Internal labour recorded by person, hours, and task
Extra expense recorded separately from ordinary expense, with the mitigation purpose noted
Saved expenses identified contemporaneously (they will be deducted; identifying them yourself preserves credibility)
Orders lost distinguished from orders delayed
Customer credits, penalties, and concessions logged
Forensic reports, vendor invoices, and communications preserved
Decisions and their commercial consequences recorded in a running memorandum
Forensic accountant engaged within the first week
Insurer notified and interim payments requested on undisputed amounts

Tool 9 — Business interruption proof of loss

1. The event. Description, dates, cause, systems affected, restoration timeline. Attach the forensic report. 2. Coverage grants invoked. [Business Interruption / Contingent BI / Extra Expense / Data Restoration], with the policy section for each. 3. Period of restoration. From [date/time] to [date/time]. Basis: the policy defines the period as [quote]. Operations returned to the condition that would have existed but for the event on [date], evidenced by [volume data]. 4. Waiting period. [N] hours applied from [time]. 5. Baseline. Method: [trend-adjusted prior period / same period prior year / order book]. Period used: . Justification: [growth rate, seasonality, order book at the time of loss]. Supporting schedules attached. 6. Actual results during the period. Revenue $. Attach the schedules. 7. Gross loss. $____ = baseline less actual. 8. Orders delayed rather than lost. $____ deducted. 9. Saved expenses. $____ deducted, itemized. 10. Extra expense. $____ , itemized, with the mitigation purpose of each item. 11. Net claim. $____. 12. Contingent BI. Provider: ____. Scheduled at Section . Loss attributable: $. 13. Exhibits index.

Tool 10 — Claims runbook

Two pages. Kept current. Tested annually.

TRIGGERS — forward any of these to [legal contact] the same day Complaint or lawsuit · written demand for money or relief · shareholder demand letter · books and records demand · subpoena · regulator inquiry or formal order · Wells notice · tolling request · arbitration notice · ransom demand · breach notification from a vendor · card brand assessment · any incident affecting systems or data

NOTICE MATRIX

Policy Carrier No. Limit Attaches at Notice address Method Deadline

D&O Primary

D&O XS 1

D&O XS 2

Side A

Cyber

Crime

E&O

ROLES Assess against all policies within 72 hours: ____ Draft and send notices: ____ Inform broker: ____ Inform CFO / board: ____ (threshold: ____)

PRE-APPROVED Panel counsel: ____ · Incident response: ____ · Forensics: ____ · Forensic accountant: ____ · Coverage counsel: ____ (conflicts cleared [date])

FIRST-PARTY Activate the incident cost capture protocol immediately. Cost centre code: ____

Tool 11 — Board insurance report

ANNUAL INSURANCE REPORT — [Date]

D&O tower. [Diagram: layers, carriers, limits, attachment points, premiums.] Dedicated Side A: $____.

The five provisions, quoted:

Conduct exclusion trigger: "____"

Insured v. insured carve-outs: "____"

Side A rescindability and application severability: "____"

Allocation: "____"

Exhaustion: "____"

Scenario 1 — securities class action, derivative suit, and investigation. Estimated defence and settlement $. Available to individuals after entity claims: $. Scenario 2 — insolvency, non-indemnifiable loss. Responding coverage: $____.

On a change of control. Run-off: [terms]. Who buys it: ____. When: ____.

Cyber. Limit $. Material sublimits: [list]. Modelled total outage cost $ against payable $____. Critical providers scheduled: [yes/no]. Waiting period: ___ hours against measured restoration time of ___ days. War exclusion attribution standard: ____. Application representations verified [date] by ____.

Changed this year: ____ Requested and not obtained: ____ Recommended for next renewal: ____

Tool 12 — Run-off checklist for a transaction

Change of control provision in every policy identified and read
Run-off quoted and bound before closing — not left to a post-closing covenant
Term: six years
Non-cancellable and fully earned
Limit sized for six years of claims, not one
Dedicated Side A within the run-off
Conduct exclusion trigger and insured-versus-insured carve-outs at least as favourable as the expiring programme
Bound policy delivered at closing and retained by a party with an interest in enforcing it
Merger agreement indemnification and insurance covenants reconciled against the actual policy
Former directors and officers notified of the run-off, with a copy available on request
Acquirer's programme checked: subsidiary definition, prior acts, retroactive date
Target's circumstance notices and open claims disclosed and diligenced

Tool 13 — Payment verification procedure

The cheapest social engineering control, and the one insurers ask about.

Any change to a vendor's banking details requires all of the following:

A callback to a telephone number held in the vendor master file before the change request — never a number in the request, in an email signature, or on a letterhead supplied with the request.

Confirmation from a named individual at the vendor previously known to the company.

Dual authorization: the person taking the callback may not be the person approving the change.

A documented record of the callback: date, time, number dialled, person spoken to, and who performed it.

A hold period of [two] business days between the change and the first payment on new details.

Any payment above $[threshold] to a new payee requires dual authorization and a callback on the same terms.

Any request that is urgent, confidential, or from an executive travelling is treated as higher risk, not lower. Urgency is the most common feature of a fraudulent request.

This procedure must match the verification condition in the cyber policy's social engineering endorsement. If the two differ, change one of them — today.